A858DE45F56D9BC9 archive

201305161453 1efs34

explained decrypted filler

seed 612

Metadata

Post ID
1efs34
Title
201305161453 → 2013-05-16 14:53 on A858's clock
Posted (UTC)
2013-05-16 06:54:01
Timezone
UTC+8 · title 14:53 against posted 06:54 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201305161453) = 6589474fa97b4fa6032d2dae333f3781 (name+title)
GUIDs
36
Filler GUID seed
new Random(612).Next(9) ✓ verified
Run
Run 46 (seed 39,043,781) (seed)
Draw
14 · predicted N = 36 ✓
Machine boot
2013-05-15 03:07–10:31 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

7A6865174B777A33 0E8C386FDDEDBEF7 6C39977CE7F353FA 16A7B5BF5DD2454E F3CFBFC9FF339A03 B55FBC61BD056D04 D887F03614259D70 63ABA2997B127C06 3E10705240A69A6B 90DCD16A58A8D26E A09BBE038E7414E9 523C14168616F869 E283E3B352B7805D 07BD16BF1C028D4E E07CF5D764E0D881 9CC211175299AE49 89E9A7E6E179C7C3 0B9C75873D70D99B 60631C3C96FCE550 C1D2E0ED53F1056A 5AD5BBDDB781F0A8 482629745F4BB9A7 EEABD8DABF302267 1AE1A257A0CC638F D1E0D18085372184 ABFF5CA2C8648B50 0A4BD07986D2F6C8 E636ACA5E0E4AC49 09D54012C8ECDACD 110D67B4134F0D9F 0CC2814AACF89BFF 7ED72D4FF0010D4F BD3F8EAA3F174B4D 839590DF142D4504 6D1E8406A4185AEB 2F68A6B745A42531 ADE129342A8BA935 65E9A6FA4E76AECC 6AE5E625E1304737 CEB92C822A4A459F ABA246B93305A5D3 D8332DBC36130F34 B2BC12F5082878C9 9DE1F80BE14B09A1 581F5D943B547D5C 4ACC8B4903A187FE A136F645FBF148C3 98883F3D063CC1C1 93A3D78F895E8519 07BA36A9A9D371EC 8CE416AE6B0B1469 208E722E4C25B04E 11EEAC37D595FF44 F6C2A44BFA4EAF4A 9E0F20E03DBFB069 7416D851B61E2843 EAF6861526B71696 04C581D18AD14EA7 16F79B61A9727CB0 F355ADD53AE9920D 28EB3C5FA59D3D50 3E8A3539CDA272A6 F955F9965944D698 458D532D886765BB 3285FEAD147BCF22 C9B4ABC40F1713CA B1C3517523122538 4F72DE2BE4392744 99AD4E9A6867E412 36B7ABDABA4029AC 7433B30393A1FBB9 24E4F74B0C569AB6 7F160FD45412CF17 7BC680062090CCB6 FB1D7D9B3EC3D7C7 7E6E3B72BAD93421 68A4EB5337F4A86E 0555AB6325098B08 FB919ECE4EA968B4 391192BA049B28CB 49CAC9ECE32EB104 3EE0914FB717B85A 09B997B2C83106D6 DE4BC5CA4F5FF097 B9358DBE87038113 E5B23F4B71E9DFEE F26AE4B8826CC456 CF85167406DE9723 32971F8895B90F70 2D70D822613F2575 240319A25DDF96B3 B2578950E86B1BE6 11D0D09BB8D7A8C2 8A6F7A0C0D76F3B0 E9A393E196127AC7 FBAB5B635F6E10FD 449BF942492D219F 4B9B009C33340B3A 0944CED99589EEFA D27917224508D800 98B698CB06F52CB2 76FA477270477FFE 96F4D2AEB1BA0486 A56D10A40B6AC2C8 4FE321D61BF495C4 CE88D1DB7F47A3B8 0FC16A7960C3FB2A 0AFA99C34479BD80 D88C8B01ED9D5349 B2097FF0C88F78BE 9A2C5E2E2220F840 134681B1ABDA0323 F1F895DFB5D7F066 973A0B880D497642 8D65EACB1970B739 DE8023337FA345A7 61700230FEDFB587 C21DBEFE42367250 07D3A83411FEDC53 73B607EB97C38EC7 4304BA41B8645664 738063798FAC2636 46D1A2978D8F8420 23870CE171F72AE3 200624FA4A37BDA5 E23DC97A6E793D56 AB0B1E2A0B292788 25A99166919F9BB1 7D142B440A6CA022 60828639B85D9ACE 0F71A72EDB6B866D ADCA3F5757EC6E51 EB2FDE3DE52E3093 1C87FF785443F3AA A3385B4EE629C9EC CFE433454FCDFC10 DF9876C5BB4B24BD 87AB01C89DDC53A2 47B8E3C0CF7DD0CD E5B155C2EBB28B60 7F418291284C93AA 3173D1D6DF6C2BFD A603B7F4DBEE37C4 247CC823AF82FF62 C51A41B2BAD4C861
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201305161453 (name+title). Key = MD5(password) = 6589474fa97b4fa6032d2dae333f3781, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1730af22-1648-4e44-83e4-9f6b71a6f7de
  2 70c4b7d2-6119-3ed3-bc7b-58b3fca3c756
  3 d4fe555d-1110-45d2-ae40-fcc70512aef3
  4 0ecd9f7c-788d-144f-bb53-a8ad48a32975
  5 3a5f29fa-8dae-4c0f-ae16-295ecbe92811
  6 de5348f4-1b9d-32de-9155-89fdecb33e27
  7 b9133a98-6d1e-10c6-aed7-f325f7a34eef
  8 0a3e551a-39df-454e-a006-2559b088fda6
  9 937db84a-4366-6206-a12e-f3b0529e2c8b
 10 feda231b-0688-860e-8bfb-c979c8a83e40
 11 277f18cb-1b3a-1e00-9e77-d8c56f9da86f
 12 45120cd0-7bbd-2c66-8331-d96eea510a70
 13 334e6182-ea81-3a60-a46d-3b316ab77294
 14 2ea620a8-a952-70cb-a7a0-104341e8fb11
 15 2301addd-b784-349b-93e4-ea17422a5834
 16 14ec3b10-2a54-26be-8a96-9f8f4e34b92a
 17 09fd0338-11a1-11f5-9f52-ee5fc32ae503
 18 95ca7d60-6e75-37e2-a8ef-a8da500e9a8b
 19 f5638299-4afa-2472-a90f-46a03e42ce31
 20 89ef2265-d784-2cb3-b593-45b7f6bf2b50
 21 f42d6776-a57e-1ab2-822c-91a153c085b5
 22 4911c40a-3c3c-885c-a8a6-5e8a3d2e2cce
 23 1672a7dd-c706-30ac-9a25-870256277a37
 24 fe62fc83-05df-7aba-84c5-3678fc399e63
 25 dbecebe8-4707-6cc1-a607-a20ca757ee96
 26 5605f1a2-f4c3-18aa-ba6b-e10d9ea0e2f0
 27 a28dc715-c7cc-018b-84b4-2e2d3536aaf3
 28 9cd10de7-58b4-75e9-9303-597058d36751
 29 ae013a3b-e027-5a27-beb1-d01a53cf71e2
 30 a9bebe10-8297-8959-8eb7-5f2ae028e419
 31 153d3ecf-d9d9-11da-b7b1-019e528c3f5c
 32 e09b0089-0207-5eba-b7fe-ead7bb7b6e99
 33 8df807f5-b659-3846-9813-3f964bc5920d
 34 67174a98-84f7-2895-a5fb-d8049da4c7b2
 35 55d11d90-8587-393b-8afa-0cf9214dbe91
 36 88a33c4a-44a7-2bf9-ba46-5cc1a00324f0

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 434143146812373213221837610758153232. Exactly this sequence comes out of new Random(612).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 14 of Run 46 (seed 39,043,781): new Random(39043781), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-05-15 03:07–10:31).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs